Stochastic Training for Side-Channel Resilient AI

2025-06-07

AI Summary

Edge AI models deployed on resource-constrained devices such as Edge TPUs are vulnerable to power/EM side-channel attacks, leading to leakage of model parameters. To address this, we propose a lightweight defense paradigm integrated into the training phase: it injects stochasticity via randomized weight remapping, dynamic computational graph permutation, and noise-robust training—thereby establishing an end-to-end stochastic inference mechanism. This mechanism inherently obfuscates physical side-channel leakage paths during inference, requiring no hardware or software modifications. To our knowledge, this is the first side-channel-resistant training method compatible with commercially deployed Edge TPUs. Experiments on the Google Coral Edge TPU demonstrate a 3.2× reduction in t-score growth rate and significant suppression of information leakage within 20,000 traces. The model accuracy degrades by only ~1%, with zero runtime overhead.

Technology Category

• Machine Learning: Learning on the Edge & Model Compression
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Privacy-enhancing technologies
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

The confidentiality of trained AI models on edge devices is at risk from side-channel attacks exploiting power and electromagnetic emissions. This paper proposes a novel training methodology to enhance resilience against such threats by introducing randomized and interchangeable model configurations during inference. Experimental results on Google Coral Edge TPU show a reduction in side-channel leakage and a slower increase in t-scores over 20,000 traces, demonstrating robustness against adversarial observations. The defense maintains high accuracy, with about 1% degradation in most configurations, and requires no additional hardware or software changes, making it the only applicable solution for existing Edge TPUs.

Problem

• Enhancing AI model resilience against side-channel attacks
• Reducing side-channel leakage without hardware changes
• Maintaining high accuracy while preventing adversarial observations

Innovation

• Randomized interchangeable model configurations during inference
• Reduces side-channel leakage on Edge TPUs
• No additional hardware or software changes needed